CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12413
https://notcve.org/view.php?id=CVE-2020-12413
16 Feb 2023 — The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites. • https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413 • CWE-203: Observable Discrepancy •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25735 – Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey
https://notcve.org/view.php?id=CVE-2023-25735
16 Feb 2023 — Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-af... • https://bugzilla.mozilla.org/show_bug.cgi?id=1810711 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25729 – Mozilla: Extensions could have opened external schemes without user knowledge
https://notcve.org/view.php?id=CVE-2023-25729
16 Feb 2023 — Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Permission prompt... • https://bugzilla.mozilla.org/show_bug.cgi?id=1792138 • CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25737 – Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry
https://notcve.org/view.php?id=CVE-2023-25737
16 Feb 2023 — An invalid downcast from nsTextNode to SVGElement could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: An invalid downcast from `nsTextNode` to `SVGElement` could have lead to undefined behavior. Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an atta... • https://bugzilla.mozilla.org/show_bug.cgi?id=1811464 • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25739 – Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext
https://notcve.org/view.php?id=CVE-2023-25739
16 Feb 2023 — Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in ScriptLoadContext. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in `ScriptLoadContext`. USN-5880-1 fixed vulnerabilities in Firefox. The update ... • https://bugzilla.mozilla.org/show_bug.cgi?id=1811939 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-25742 – Mozilla: Web Crypto ImportKey crashes tab
https://notcve.org/view.php?id=CVE-2023-25742
16 Feb 2023 — When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. The Mozilla Foundation Security Advisory describes this flaw as: When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. USN-5880-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. • https://bugzilla.mozilla.org/show_bug.cgi?id=1813424 • CWE-173: Improper Handling of Alternate Encoding •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23606 – Gentoo Linux Security Advisory 202305-06
https://notcve.org/view.php?id=CVE-2023-23606
23 Jan 2023 — Memory safety bugs present in Firefox 108. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 109. USN-5816-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1764974%2C1798591%2C1799201%2C1800446%2C1801248%2C1802100%2C1803393%2C1804626%2C1804971%2C1807004 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-23599 – Mozilla: Malicious command could be hidden in devtools output
https://notcve.org/view.php?id=CVE-2023-23599
23 Jan 2023 — When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. The Mozilla Foundation Security Advisory describes this flaw as: When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within.... • https://bugzilla.mozilla.org/show_bug.cgi?id=1777800 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23604 – Gentoo Linux Security Advisory 202305-06
https://notcve.org/view.php?id=CVE-2023-23604
23 Jan 2023 — A duplicate <code>SystemPrincipal</code> object could be created when parsing a non-system html document via <code>DOMParser::ParseFromSafeString</code>. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109. USN-5816-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. • https://bugzilla.mozilla.org/show_bug.cgi?id=1802346 • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23597 – Gentoo Linux Security Advisory 202305-06
https://notcve.org/view.php?id=CVE-2023-23597
23 Jan 2023 — A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the <code>file://</code> context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefox < 109. USN-5816-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. • https://bugzilla.mozilla.org/show_bug.cgi?id=1538028 • CWE-326: Inadequate Encryption Strength •